who’s still selling $red?
i went into this with a pretty basic assumption: the airdrop was ages ago, discord feels quiet, surely most farmers who wanted out have already left.
so who’s still hitting the bid?
i asked @SurfAIHQ to look into it. the report surfaced a wallet, 0x5227…2f8c, that received roughly 11.96m red from binance and subsequently sent tokens into pancakeswap.
then the address check changed the story.
etherscan labels it “binance hot wallet exploiter 2.”
the red arrived from binance 14 on october 29 at 20:24 utc, in the transaction associated with the exploit. that’s a pretty important detail to leave out of a seller analysis. incoming tx
etherscan.io/tx/0x53bd38b816…
and there’s an actual swap to point at: on october 30 at 02:44 utc, the wallet exchanged about 2.60m red for 51.30 eth through pancakeswap. swap transaction etherscan.io/tx/0x401b9e2ffb…
okay, that answers part of my question.
there was an exploit-linked seller in this episode. blaming the remaining airdrop crowd for that flow would miss what actually happened.
it also exposed a hole in my own starting assumption. a quiet discord tells me how the community feels. it tells me fuck all about who still holds tokens.
surf was useful here because it gave me a specific address to investigate. but its write-up missed the exploiter label, and the claim about 65 identical sell clips doesn’t add up. i’d use this workflow again; i’d still check the transactions before posting the conclusion.
the unlock argument needs the same discipline. scheduled supply matters, but “tokens unlocked” and “backers sold” are different claims. show me where the tokens went.
my take: this gives us a concrete seller for the october 30 episode. it doesn’t explain months of weak price action, prove investors are dumping, or mean the sell pressure is over.
i started by asking which holders were still selling. the strongest lead took me straight back to the binance exploit.
that’s the part worth paying attention to.
u can test: asksurf.ai/chat
pretty gud result to reserch on chain activity
Woke up thinking: lads, this looks like a solid accumulation zone.
While ETH fills that ETF gap, I’m looking to stack more. 2150 would be a sweet spot to full load up. Then hopefully we send it higher
And a little alpha: once your ETH bags are loaded, you can put them to work on @domaprotocol
ran the binance recovery question through Surf. ai (ultra mode). mixed bag, honestly.
the useful part: it separated frozen funds, assets returned to binance, and compensation from the exchange’s own reserves.
that matters. “we’ll cover the losses” doesn’t tell me whether the stolen funds came back. neither does a frozen balance.
the on-chain part fell short. surf reported that its ethereum and arbitrum queries returned zero rows across every date it tested. no successful independent verification behind those numbers — they came from published reports.
there was also an allo correction. the first answer blurred recovery in progress with a completed return. i asked which source confirmed receipt, and surf walked that back.
so yeah, useful for untangling a messy story. but i still had to push it on a distinction the research was supposed to establish.
my take: decent source synthesis, unsuccessful on-chain verification in this run. on ultra, i wanted that last bit to actually work.
@SurfAIHQ
Bybit. Bitget. Polymarket. Now Binance. What is going on?
Feb 21, 2025: Bybit gets drained for ~$1.46B. Sep 24, 2026: Bitget takes a ~$387.5M hit.
Oct 29: Polymarket pauses trading after a third-party breach. Later that evening, billions start leaving Binance. Different incidents, same nightmare on repeat. Ngl, I’m tired of this timeline.
TRM Labs puts the Binance outflows at ~$6.36B, with most funds moved in roughly 20 minutes. Let that sink in.
Oct 29 / UTC:
• 20:20 — malicious EIP-7702 delegation goes live on a Binance wallet.
• 20:24 — 167,464 ETH + 1.615B USDT, plus other tokens, gone in a single tx.
• 21:01 / 21:04 — Tether and Circle freeze funds at the main receiving address.
Binance’s initial findings point to a compromised DevOps laptop giving the attacker access to internal withdrawal infrastructure. No evidence of leaked private keys so far, according to the exchange. Around $3B frozen, losses promised to be covered. But frozen ≠ recovered. And there’s no established link between the Binance and Polymarket attacks.
This is the part that gets me: I can lock down my accounts, avoid sketchy links and check every tx I sign. I can’t do OPSEC for a CEX employee or every third-party vendor behind the scenes. My own security only covers part of the stack.
At this point, “funds are safe” needs receipts. Show me what failed, what changed and whether the reserves are actually restored.
The funny thing is that AAVE just happened to get caught in the crossfire, completely at random)))
🤡The “Kim Jong-un wallet” everyone’s talking about
Wallet: debank.com/profile/0x5227f60…
To be precise: this is the Binance exploiter’s receiving address. TRM links the attack to DPRK’s TraderTraitor group — not to Kim personally.
Main drain tx: etherscan.io/tx/0x53bd38b816…
Onchain breakdown: bitquery.io/investigations/b…
TRM investigation: trmlabs.com/resources/blog/n…
Binance statement: binance.com/en-IN/support/an…
1/🧃my DOMA FC squad but make it slightly unserious
-not the safest picks
-not the cleanest locker room
-but we got 100000 aura, problems and one guy already packed his bags
@domaprotocol @d3inc
6/ 🩴 Local Hero: swimsuits.ai
Yo! this one stays!
- simple niche
-summer vibe
-easy to understand
-actually feels like something normal people would click
not the loudest card, but it’s my W guy
1- I recently had a pretty stressful crypto wallet experience. I wanted to participate in Doma and sent funds from Arbitrum to the Doma network
The transfer went through.
But then I realized Tangem didn’t support that network...
7/
Big thanks to the developer/developers behind Megnat @vilicvane
This tool can genuinely save people who accidentally send funds to a network their wallet doesn’t fully support.
I also donated to support the project — transaction is public here:














